Hi,
attached is a small patch I prepared when testing the PAC responder
patches. In my case, the user was a member of a well-known SID S-1-18-1
which didn't resolve into a domain and all his groups were skipped. I
think we should just skip the offending SID and carry on.